CVE-2026-109612

Deferred Deferred - Pending Action

Stored XSS in Frappe ERPNext Report View

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the session of any user who later opens the report.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109612

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	erpnext	0
frappe	erpnext	16.0.0-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Frappe ERPNext versions before 15.120.0 and 16.x before 16.33.0 have a stored cross-site scripting vulnerability. Authenticated users can create records with malicious names that execute scripts when other users view reports containing those names.

Detection Guidance

To detect this vulnerability, inspect report views in Frappe ERPNext for improperly escaped record names. Check if user-provided input in record names is rendered as raw HTML or JavaScript in reports. Review user-created records for suspicious names containing script tags or event handlers.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or redirect users to malicious sites. This requires an authenticated user with record creation privileges to exploit.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information.

Mitigation Strategies

Upgrade Frappe ERPNext to version 15.120.0 or later, or 16.33.0 or later if using version 16.x. Apply input validation to restrict record names to safe characters. Implement output encoding in report views to escape HTML and JavaScript. Review existing records for malicious names and remove or sanitize them.

Hi! I’m here to help you understand CVE-2026-109612. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70